CGM CLININET: Remote code execution with root privileges via HL7 processes
Summary
The CGM CLININET application server runs several processes for HL7 communication with external systems with root privileges. These processes handle untrusted data from those systems without adequate safeguards. An attacker on an adjacent network who can send data to these processes can execute code as root, without authentication or user interaction.
Affected
- CGM CLININET up to and including 2026.MS3 (confirmed by CERT Polska and the CVE record)
- Later versions may also be affected (not confirmed)
- CWE-250 (Execution with Unnecessary Privileges) per the CVE record and CERT Polska
Fixed in
Unknown. No fixed version has been published for this CVE. Do not assume that 2026.MS3 or a later version is safe.
Workaround
- No vendor mitigation has been published for this CVE.
- Restrict network access to the HL7 interfaces to known interface partners only.
- Separate the CLININET server from general and internet-facing networks.
Exploitation
- Not known to be exploited. CISA SSVC: exploitation none, not automatable.
- No public proof of concept found.
Our recommendation
- If you operate CLININET or use a provider that does, treat this as high priority.
- Ask CGM or your partner for the fixed version and the advisory, and confirm your installed version.
- Check whether the HL7 interfaces are reachable from networks outside the clinical network, and restrict them.
- Monitor HL7 traffic and activity of root processes for anomalies.
- If you do not operate CLININET, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerabilities in CGM CLININET software cert.pl
- CGM CLININET product page www.cgm.com
- Strix: CVE-2025-30046 www.strix.ai
- Hol.org: CVE-2025-30046 hol.org
- Vulners (Rapid7): CVE-2025-30046 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:03.
Original description (NVD)
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.